App Transport Security disabled for all connections
Check PB-29 · App Store Review Guideline 2.5.1 / App Transport Security · Review warning · verified 2026-09-16
Why App Review rejects under Guideline 2.5.1
This one is decided by Apple's automated scan at upload time, before a human sees the build. Private selectors (LSApplicationWorkspace, MobileGestalt, IOKit queries), the long-deprecated UIWebView, and disabled App Transport Security without justification all trip it. The symbol almost always comes from a dependency rather than your own code, so the fix is finding which pod or package contains the string and updating or replacing it.
How to fix it
Remove NSAllowsArbitraryLoads = true from NSAppTransportSecurity, or replace it with NSExceptionDomains for the specific hosts that truly need HTTP. Reviewers ask for a justification when ATS is globally disabled and reject when there is none. Expo: expo.ios.infoPlist.NSAppTransportSecurity.
How RejectProof detects it
The scan reads your .ipa in the browser (or locally with npx rejectproof): Info.plist, entitlements, the privacy manifest, embedded frameworks and the executable itself. Check PB-29 reports the exact evidence it found — the key, the symbol, the file or the URL — so you can confirm it in your own project before changing anything. Nothing is uploaded; only a small redacted summary is sent to build the report, and you see it first.